mschapv2

type AuthRequest struct {
	Challenge     []byte
	PeerChallenge []byte
}

type AuthResponse struct {
	NTResponse            []byte
	RecvKey               []byte
	SendKey               []byte
	AuthenticatorResponse string
}

type FailureRequest struct {
	*Payload
	Message string
}

type OpCode uint8

type Payload struct {
	OpCode     OpCode
	MSCHAPv2ID uint8
	MSLength   uint16
	ValueSize  uint8

	Challenge []byte
	Response  []byte

	Name []byte
	// contains filtered or unexported fields
}

type Response struct {
	Challenge  []byte
	NTResponse []byte
	Flags      uint8
}

type Settings struct {
	AuthenticateRequest func(req AuthRequest) (*AuthResponse, error)
	// AuthenticateRequestWithContext is the preferred hook when the caller needs
	// request/session-aware policy decisions. AuthenticateRequest remains
	// available for generic consumers that only need the challenge material.
	AuthenticateRequestWithContext func(ctx protocol.Context, req AuthRequest) (*AuthResponse, error)
	ServerIdentifier               string

	// Standalone selects the outer EAP-MSCHAPv2 flow (EAP type 26 run directly as
	// the outer method, per draft-kamath-pppext-eap-mschapv2), rather than as a
	// PEAP-tunnelled inner method. In standalone mode a successful exchange ends
	// with an outer EAP-Success (instead of a PEAP result TLV) and a failed one runs
	// the MS-CHAP-V2 Failure sub-protocol (RFC 2759 §6). Default false preserves the
	// PEAP-inner behaviour unchanged.
	Standalone bool

	// OnResult, when set, is invoked once with the password verdict: success=true
	// when the peer's NT-Response matched the expected one, false on mismatch. It is
	// a side-effect hook for the consumer (e.g. access/reject auditing) and must not
	// influence the exchange. It is NOT called for backend/credential errors raised
	// by AuthenticateRequest(WithContext) — the consumer already has those.
	OnResult func(ctx protocol.Context, success bool)
}

type State struct {
	Challenge       []byte
	PeerChallenge   []byte
	IsProtocolEnded bool
	AuthResponse    *AuthResponse
	// AuthFailed is set in standalone mode after the server sends an MS-CHAP-V2
	// Failure-Request, so the peer's Failure-Response is recognised and turned into
	// an outer EAP-Failure.
	AuthFailed bool
}

type SuccessRequest struct {
	*Payload
	Authenticator []byte
}